3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-fvfv-ppw4-7h2w

GHSA-fvfv-ppw4-7h2w: n8n has a Guardrail Node Bypass

Impact

An end user interacting with a workflow that uses the Guardrail node could craft an input that bypasses the default guardrail instructions.

Patches

The issue has been fixed in n8n version 2.10.0. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Limit access to trusted users.
Review asses the practical impact of guardrail bypasses in your usecase and adjust your workflow accordingly.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-fvfv-ppw4-7h2w

GHSA-fvfv-ppw4-7h2w:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	< 2.10.0	2.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows bypassing the Guardrail node in n8n. The root cause is improper validation of the output from the language model used by the guardrail. The patch, found in commit 8d0251d1deef256fd3d9176f05dedab62afde918, reveals that the Zod schema (LlmResponseSchema) used for parsing the LLM's JSON response was not strict. This allowed for additional, unexpected fields in the response, which could be manipulated by a malicious input to bypass the guardrail's checks.

The function runLLM in packages/@n8n/nodes-langchain/nodes/Guardrails/helpers/model.ts is responsible for invoking the language model and parsing its output using this schema. The patch modifies this area by adding .strict() to the LlmResponseSchema and also adds explicit type checking for the parsed fields within runLLM. Therefore, runLLM is the function that directly handles the improperly validated data and is the core of this vulnerability.

Vulnerable functions

runLLM

packages/@n8n/nodes-langchain/nodes/Guardrails/helpers/model.ts

The `runLLM` function processes output from a language model. The vulnerability lies in the loose validation of the JSON response from the model. The original Zod schema for `LlmResponseSchema` did not use `.strict()`, allowing an attacker to craft an input that would cause the language model to return a JSON object with additional, unexpected fields. This could bypass the intended guardrail logic. The patch enforces a strict schema, ensuring that any deviation from the expected two-field (`confidenceScore`, `flagged`) response is rejected.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.